Aligned the linebreak exportdom behaviour to align with how the
reconciler displays line breaks in the editor, by adding an extra line
break to each series of line breaks, so they're now visually the same
across editor and export.
Block formatting on range selection could break when made from bottom to
top, due to using the first selected for insertion position instead of
the first in the doc structure.
Updated code editor display so the editor area actually gains focus
again.
Updated modal handling to delegate focus handling to the editor if focus
was on the edit area before, to prevent cursor jumps to the start.
Cells could have an 'align' attribute, especially when created via
markdown. This updates the allow filtering to retain valid align values
on table cells.
For #6167
Updated LDAP group handling to properly handle empty group values by
checking the explode's count property instead of performing a general
array count.
Also updated logic with DN validation/filtering before LDAP calls are
made.
For #6088
For #6181
Just in users' my account area for now.
To add to admin-level actions in the future once we can better trace
session life.
Updated/added tests to cover.
Also changed the UI based forms to submit as changelog instead of
summary to align with more sensible name used on the API.
Added testing to cover.
For #6162
Actually registered the SFTP protocol with HTMLPurifier to allow SFTP
links.
Replaced the default MakeAbsolute URI filter for HTMLPurifier so that
fragment based links are allowed, and are not forced to have a base URL
and/or protocol.
For #6178, Related to #6186
Fixed lack of permission update scope in permission builder where
trashed pages on chapter permission updates would not get permission
updates.
Also added permission rebuild on restore as an extra assurance.
Added tests to cover.
Thanks to SVO — svo.com.br for reporting.
- Updates ZIP imports to validate that actual mime type of book cover
images to ensure they are a supported image file.
- Updates lower level ImageStorage to validate extensions of images when
cleaning their name pre-storage.
- Updates ZIP import Image and Book handling so book cover and image
files have their extension forced from file mime types in the same
way.
Added testing to cover.
Thanks to the submersion.ai security research team for reporting.
The lack of the filter could result in draft pages, from other users,
showing in locations like search results.
Thanks to Ahmed Ibrahim (github.com/skeletonsec) for reporting.
To prevent the ability to use the draft publish endpoint on non-draft
pages which the user may not have the ability to update by default.
Thanks to SVO for reporting.
Mainly to prevent non-image files being streamed in scenarios where the
underlying image data is somehow a non-image.
Thanks to Emanuele Cervelli (https://github.com/M4nu02) for reporting.
Specifically check the mime type of Base64 drawing data to ensure
that it reads as image data rather than anything else which could be
potentially dangerous.
Thanks to Emanuele Cervelli (https://github.com/M4nu02) for reporting.
On the change of an attachment uploaded_to (page) this ensures that a
PageUpdate permission check is made against the original attachment
page, in addition to the new page.
Thanks to Wade Sparks / ByteMe.Red for reporting.
Also added user advice on two-column layouts about how they stack on
mobile.
Changed how fixed dropdowns work, so they instead remain in place to
their events and dom handling does not need special handling.
Updated keyboard navigation so ignore elements which are hidden via CSS.
So that their metadata can be read without having to create instances
and fullfill dependancy injection just to list.
Also added title to interface prefs page.
Dan Brown